How a Single Compromise Threatened 34% of npm

On September 8, 2025, the npm account of a Qix maintainer of widely used JavaScript libraries was compromised. Malicious versions of chalk, debug, and other packages were briefly published before removal. Because Qix’s libraries are foundational to the JavaScript ecosystem, the compromise demonstrated a potential blast radius of more than 20 million packages — about 34% of the entire NPM ecosystem.